Threat Hunting in the Cloud

CHAPTER 8Threat Hunting in Other Cloud Providers

What's in This Chapter

• Overview of threat-hunting capabilities by other key cloud platform providers, including:
  • Google cloud
  • IBM cloud
  • Oracle cloud
  • Alibaba cloud

The objective of this chapter is to explore the current threat-hunting capabilities in other leading cloud service providers (CSPs) such as Google, IBM, Oracle, and Alibaba.

There are three main service models of cloud computing—Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). There are clear differences between the three and what they can offer a business in terms of storage and resource pooling, but they can also interact with each other to form one comprehensive model of cloud computing.

CAUTION Note that not all threat-hunting CSP capabilities are created equal. The primary rationale behind this is the underlying business model of CSP's value proposition (i.e., does the CSP offer IaaS, PaaS, or SaaS, or combinations of these?). The threat vectors that apply to SaaS, PaaS, and IaaS are very different. Hence, the defense mechanisms, tools, and approaches to combat these threats are also different.

Cloud platform providers of IaaS, PaaS, and SaaS have built or adopted threat-hunting capabilities to protect their customer's data residing on their platform. We went deeper into Microsoft Azure and AWS threat-hunting capabilities in previous chapters. Let's take a look at threat-hunting capabilities of ...